<!-- build time:Tue Jul 21 2020 12:41:25 GMT+0800 (GMT+08:00) --><!DOCTYPE html><html lang="zh-CN"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=2"><meta name="theme-color" content="#222"><meta name="generator" content="Hexo 4.2.0"><link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png"><link rel="icon" type="image/png" sizes="32x32" href="/img/blog_favicon/favicon-32x32-next.png"><link rel="icon" type="image/png" sizes="16x16" href="/img/blog_favicon/favicon-16x16-next.png"><link rel="mask-icon" href="/images/logo.svg" color="#222"><meta name="baidu-site-verification" content="r15J5zOS2KI43yBS"><link rel="stylesheet" href="/css/main.css"><link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"><link rel="stylesheet" href="//cdn.jsdelivr.net/gh/fancyapps/fancybox@3/dist/jquery.fancybox.min.css"><link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/pace/1.0.2/themes/blue/pace-theme-minimal.min.css"><script src="//cdnjs.cloudflare.com/ajax/libs/pace/1.0.2/pace.min.js"></script><script id="hexo-configurations">var NexT=window.NexT||{},CONFIG={hostname:new URL("http://www.zhengjiaao.cn").hostname,root:"/",scheme:"Muse",version:"7.6.0",exturl:!1,sidebar:{position:"left",display:"post",padding:18,offset:12,onmobile:!1},copycode:{enable:!0,show_result:!0,style:null},back2top:{enable:!0,sidebar:!1,scrollpercent:!0},bookmark:{enable:!0,color:"#222",save:"auto"},fancybox:!0,mediumzoom:!1,lazyload:!1,pangu:!1,comments:{style:"tabs",active:"valine",storage:!0,lazyload:!1,nav:null,activeClass:"valine"},algolia:{appID:"",apiKey:"",indexName:"",hits:{per_page:10},labels:{input_placeholder:"Search for Posts",hits_empty:"We didn't find any results for the search: ${query}",hits_stats:"${hits} results found in ${time} ms"}},localsearch:{enable:!0,trigger:"auto",top_n_per_article:1,unescape:!1,preload:!1},path:"search.xml",motion:{enable:!0,async:!1,transition:{post_block:"fadeIn",post_header:"slideDownIn",post_body:"slideDownIn",coll_header:"slideLeftIn",sidebar:"slideUpIn"}}}</script><meta property="og:type" content="article"><meta property="og:title" content="Docker五种网络管理"><meta property="og:url" content="http://www.zhengjiaao.cn/posts/2253856034.html"><meta property="og:site_name" content="宇宙小神特别萌"><meta property="og:locale" content="zh_CN"><meta property="og:image" content="https://upload-images.jianshu.io/upload_images/15645795-de1fe080ff3648fe.png"><meta property="og:image" content="https://upload-images.jianshu.io/upload_images/15645795-ac6abc9b4320fe68.png"><meta property="article:published_time" content="2020-01-03T08:14:49.000Z"><meta property="article:modified_time" content="2020-07-20T10:37:55.297Z"><meta property="article:author" content="宇宙小神特别萌"><meta property="article:tag" content="Docker"><meta name="twitter:card" content="summary"><meta name="twitter:image" content="https://upload-images.jianshu.io/upload_images/15645795-de1fe080ff3648fe.png"><link rel="canonical" href="http://www.zhengjiaao.cn/posts/2253856034.html"><script id="page-configurations">CONFIG.page={sidebar:"",isHome:!1,isPost:!0}</script><title>Docker五种网络管理 | 宇宙小神特别萌</title><noscript><style>.sidebar-inner,.use-motion .brand,.use-motion .collection-header,.use-motion .comments,.use-motion .menu-item,.use-motion .pagination,.use-motion .post-block,.use-motion .post-body,.use-motion .post-header{opacity:initial}.use-motion .site-subtitle,.use-motion .site-title{opacity:initial;top:initial}.use-motion .logo-line-before i{left:initial}.use-motion .logo-line-after i{right:initial}</style></noscript><link rel="alternate" href="/atom.xml" title="宇宙小神特别萌" type="application/atom+xml"></head><body itemscope itemtype="http://schema.org/WebPage"><div class="container use-motion"><div class="headband"></div><header class="header" itemscope itemtype="http://schema.org/WPHeader"><div class="header-inner"><div class="site-brand-container"><div class="site-meta custom-logo"><div class="site-meta-headline"><a><img class="custom-logo-image" src="/img/blog_favicon/favicon-32x32-next.png" alt="宇宙小神特别萌"></a></div><div><a href="/" class="brand" rel="start"><span class="logo-line-before"><i></i></span> <span class="site-title">宇宙小神特别萌</span> <span class="logo-line-after"><i></i></span></a></div><p class="site-subtitle">ZhengJa</p></div><div class="site-nav-toggle"><div class="toggle" aria-label="切换导航栏"><span class="toggle-line toggle-line-first"></span> <span class="toggle-line toggle-line-middle"></span> <span class="toggle-line toggle-line-last"></span></div></div></div><nav class="site-nav"><ul id="menu" class="menu"><li class="menu-item menu-item-home"><a href="/" rel="section"><i class="fa fa-fw fa-home"></i>首页</a></li><li class="menu-item menu-item-tags"><a href="/tags/" rel="section"><i class="fa fa-fw fa-tags"></i>标签<span class="badge">27</span></a></li><li class="menu-item menu-item-archives"><a href="/archives/" rel="section"><i class="fa fa-fw fa-archive"></i>归档<span class="badge">116</span></a></li><li class="menu-item menu-item-sitemap"><a href="/sitemap.xml" rel="section"><i class="fa fa-fw fa-sitemap"></i>站点地图</a></li><li class="menu-item menu-item-messageboard"><a href="/messageboard/" rel="section"><i class="fa fa-fw fa-address-book"></i>留言板</a></li><li class="menu-item menu-item-links"><a href="/links/" rel="section"><i class="fa fa-fw fa-user-plus"></i>友链</a></li><li class="menu-item menu-item-shuoshuo"><a href="/shuoshuo/" rel="section"><i class="fa fa-fw fa-file-text-o"></i>说说</a></li><li class="menu-item menu-item-search"><a role="button" class="popup-trigger"><i class="fa fa-search fa-fw"></i>搜索</a></li></ul></nav><div class="site-search"><div class="popup search-popup"><div class="search-header"><span class="search-icon"><i class="fa fa-search"></i></span><div class="search-input-container"><input autocomplete="off" autocorrect="off" autocapitalize="none" placeholder="搜索..." spellcheck="false" type="text" id="search-input"></div><span class="popup-btn-close"><i class="fa fa-times-circle"></i></span></div><div id="search-result"></div></div><div class="search-pop-overlay"></div></div></div></header><div class="back-to-top"><i class="fa fa-arrow-up"></i> <span>0%</span></div><div class="reading-progress-bar"></div><a role="button" class="book-mark-link book-mark-link-fixed"></a> <a href="https://github.com/zhengjiaao" class="github-corner" title="Follow me on GitHub" aria-label="Follow me on GitHub" rel="noopener" target="_blank"><svg width="80" height="80" viewBox="0 0 250 250" aria-hidden="true"><path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path><path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2" fill="currentColor" style="transform-origin:130px 106px" class="octo-arm"></path><path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z" fill="currentColor" class="octo-body"></path></svg></a><main class="main"><div class="main-inner"><div class="content-wrap"><div class="content"><div class="posts-expand"><article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN"><link itemprop="mainEntityOfPage" href="http://www.zhengjiaao.cn/posts/2253856034.html"><span hidden itemprop="author" itemscope itemtype="http://schema.org/Person"><meta itemprop="image" content="/my-images/avatar.gif"><meta itemprop="name" content="宇宙小神特别萌"><meta itemprop="description" content="人生就是一次幸运的旅行！"></span><span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization"><meta itemprop="name" content="宇宙小神特别萌"></span><header class="post-header"><h1 class="post-title" itemprop="name headline">Docker五种网络管理</h1><div class="post-meta"><span class="post-meta-item"><span class="post-meta-item-icon"><i class="fa fa-calendar-o"></i> </span><span class="post-meta-item-text">发表于</span> <time title="创建时间：2020-01-03 16:14:49" itemprop="dateCreated datePublished" datetime="2020-01-03T16:14:49+08:00">2020-01-03</time> </span><span class="post-meta-item"><span class="post-meta-item-icon"><i class="fa fa-calendar-check-o"></i> </span><span class="post-meta-item-text">更新于</span> <time title="修改时间：2020-07-20 18:37:55" itemprop="dateModified" datetime="2020-07-20T18:37:55+08:00">2020-07-20</time> </span><span id="/posts/2253856034.html" class="post-meta-item leancloud_visitors" data-flag-title="Docker五种网络管理" title="热度"><span class="post-meta-item-icon"><i class="fa fa-eye"></i> </span><span class="post-meta-item-text">热度：</span> <span class="leancloud-visitors-count"></span> <span>℃</span> </span><span class="post-meta-item" title="热度" id="busuanzi_container_page_pv" style="display:none"><span class="post-meta-item-icon"><i class="fa fa-eye"></i> </span><span class="post-meta-item-text">热度：</span> <span id="busuanzi_value_page_pv"></span> </span><span class="post-meta-item"><span class="post-meta-item-icon"><i class="fa fa-comment-o"></i> </span><span class="post-meta-item-text">Valine：</span> <a title="valine" href="/posts/2253856034.html#comments" itemprop="discussionUrl"><span class="post-comments-count valine-comment-count" data-xid="/posts/2253856034.html" itemprop="commentCount"></span></a></span><br><span class="post-meta-item" title="本文字数"><span class="post-meta-item-icon"><i class="fa fa-file-word-o"></i> </span><span class="post-meta-item-text">本文字数：</span> <span>20k</span> </span><span class="post-meta-item" title="阅读时长"><span class="post-meta-item-icon"><i class="fa fa-clock-o"></i> </span><span class="post-meta-item-text">阅读时长 &asymp;</span> <span>18 分钟</span></span></div></header><div class="post-body" itemprop="articleBody"><meta name="referrer" content="no-referrer"><a id="more"></a><p><img src="https://upload-images.jianshu.io/upload_images/15645795-de1fe080ff3648fe.png" alt="docker五种网络管理目录.png"></p><h2 id="一、有哪五种模式网络："><a href="#一、有哪五种模式网络：" class="headerlink" title="一、有哪五种模式网络："></a>一、有哪五种模式网络：</h2><p>docker的网络模式大致可以分成五种类型:</p><ul><li><p>默认是bridge模式网络 使用–net =bridge指定 ，默认网络驱动程序。当你的应用程序在需要通信的独立容器中运行时 ，通常会使用桥接网络。</p></li><li><p>host模式网络 使用–net =host指定 ，对于独立容器 ，删除容器和Docker主机之间的网络隔离 ，并直接使用主机的网络</p></li><li><p>none模式网络 使用–net =none指定 ，对于此容器 ，禁用所有网络<br>另外两种：</p></li><li><p>container模式网络 使用–net =container:指定容器名 ，可以多个容器共用一个网络</p></li><li><p>user-defined模式网络：</p><ul><li>overlay模式网络 使用–net=overlay ，覆盖网络将多个Docker守护程序连接在一起 ，并使群集服务能够相互通信。还可以使用覆盖网络来促进群集服务和独立容器之间的通信 ，或者在不同Docker守护程序上的两个独立容器之间进行通信</li><li>macvlan：Macvlan网络允许您为容器分配MAC地址 ，使其显示为网络上的物理设备。Docker守护程序通过其MAC地址将流量路由到容器。macvlan 在处理期望直接连接到物理网络的传统应用程序时 ，使用驱动程序有时是最佳选择 ，而不是通过Docker主机的网络堆叠进行路由</li></ul></li></ul><p>在安装完docker之后 ，宿主机上会创建三个网络：<br>默认docker主机会存在三种类型的网络 ，可以使用docker network ls命令查看</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker network ls</span><br><span class="line">NETWORK ID          NAME                DRIVER              SCOPE</span><br><span class="line">f88b1c490d20        bridge              bridge              local</span><br><span class="line">0954ad9627bc        host                host                local</span><br><span class="line">7dbe186a84e8        none                null                local</span><br></pre></td></tr></table></figure><h3 id="1-bridge模式网络"><a href="#1-bridge模式网络" class="headerlink" title="1.bridge模式网络"></a>1.bridge模式网络</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">容器的默认网络模式 ，docker在安装时会创建一个名为docker0的Linux bridge ，在不指定--network的情况下 ，创建的容器都会默认挂到docker0上面</span><br><span class="line"></span><br><span class="line">在该模式（见下图）中 ，Docker守护进程创建了一个虚拟以太网桥&#96;docker0&#96; ，附加在其上的任何网卡之间都能自动转发数据包。默认情况下 ，守护进程会创建一对对等接口 ，将其中一个接口设置为容器的eth0接口 ，另一个接口放置在宿主机的命名空间中 ，从而将宿主机上的所有容器都连接到这个内部网络上。同时 ，守护进程还会从网桥的私有地址空间中分配一个IP地址和子网给该容器</span><br></pre></td></tr></table></figure><p>1.1 如 ，docker主机会有一个默认使用的桥接网卡bridge0 ，它是在运行docker容器时 ，如果不指定网络 ，默认使用的网络:docker0</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# ip a</span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link&#x2F;loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1&#x2F;8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1&#x2F;128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link&#x2F;ether 52:54:00:69:06:60 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.16.0.6&#x2F;20 brd 172.16.15.255 scope global eth0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::5054:ff:fe69:660&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;NO-CARRIER,BROADCAST,MULTICAST,UP&gt; mtu 1500 qdisc noqueue state DOWN group default </span><br><span class="line">    link&#x2F;ether 02:42:74:13:f5:ff brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1&#x2F;16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::42:74ff:fe13:f5ff&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br></pre></td></tr></table></figure><p>1.2 当运行一个容器时 ，我们可以看到在docker主机上多了一个网卡（vethd579570@if38） ，而且master指向docker0</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker run -d -P --net&#x3D;bridge nginx:1.9.1</span><br><span class="line">59abbf7dbeedf974349fd971970300e311d4ff56aef7e17f8071ec84e8b8e795</span><br><span class="line">[root@VM_0_6_centos ~]# ip a</span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link&#x2F;loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1&#x2F;8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1&#x2F;128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link&#x2F;ether 52:54:00:69:06:60 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.16.0.6&#x2F;20 brd 172.16.15.255 scope global eth0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::5054:ff:fe69:660&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue state UP group default </span><br><span class="line">    link&#x2F;ether 02:42:74:13:f5:ff brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1&#x2F;16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::42:74ff:fe13:f5ff&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">39: vethd579570@if38: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker0 state UP group default </span><br><span class="line">    link&#x2F;ether 7e:79:90:55:97:1d brd ff:ff:ff:ff:ff:ff link-netnsid 0</span><br><span class="line">    inet6 fe80::7c79:90ff:fe55:971d&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br></pre></td></tr></table></figure><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">因为bridge模式是Docker的默认设置 ，所以你也可以使用&#96;docker run -d -P nginx:1.9.1&#96;。如果你没有使用-P（发布该容器暴露的所有端口）或者-p</span><br><span class="line">host_port:container_port（发布某个特定端口） ，IP数据包就不能从宿主机之外路由到容器中。</span><br></pre></td></tr></table></figure><p>1.3 这时候我们在查看该容器的网络信息（ip地址和网关）。发现它的ip地址和docker0一个网段 ，网关则是docker0的地址</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker ps</span><br><span class="line">CONTAINER ID        IMAGE               COMMAND                  CREATED              STATUS              PORTS                                           NAMES</span><br><span class="line">59abbf7dbeed        nginx:1.9.1         &quot;nginx -g &#39;daemon of…&quot;   About a minute ago   Up About a minute   0.0.0.0:32771-&gt;80&#x2F;tcp, 0.0.0.0:32770-&gt;443&#x2F;tcp   competent_cori</span><br><span class="line">[root@VM_0_6_centos ~]# docker inspect -f &#123;&#123;&quot;.NetworkSettings.Networks.bridge.IPAddress&quot;&#125;&#125; 59abbf7dbeed</span><br><span class="line">172.17.0.2</span><br><span class="line">[root@VM_0_6_centos ~]# docker inspect -f &#123;&#123;&quot;.NetworkSettings.Networks.bridge.Gateway&quot;&#125;&#125; 59abbf7dbeed</span><br><span class="line">172.17.0.1</span><br></pre></td></tr></table></figure><p>1.4 bridge网络的特点</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">使用一个 linux bridge ，默认为 docker0</span><br><span class="line">使用veth 对 ，一头在容器的网络 namespace中 ，一头在docker0上</span><br><span class="line">该模式下Docker Container不具有一个公有IP ，因为宿主机的IP地址与veth pair的IP地址不在同一个网段内</span><br><span class="line">Docker采用NAT方式 ，将容器内部的服务监听的端口与宿主机的某一个端口进行“绑定” ，使得宿主机以外的世界可以主动将网络报文发送至容器内部</span><br><span class="line">外界访问容器内的服务时 ，需要访问宿主机的 IP 以及宿主机的端口 port</span><br><span class="line">NAT 模式由于是在三层网络上的实现手段 ，故肯定会影响网络的传输效率。</span><br><span class="line">容器拥有独立、隔离的网络栈；让容器和宿主机以外的世界通过NAT建立通信</span><br></pre></td></tr></table></figure><p>我们查看iptables的nat表 ，可以看到 ，在POSTROUTING链上做了一个MASQUERADE ，源是172.17.0.0/1</p><h3 id="2-host模式网络"><a href="#2-host模式网络" class="headerlink" title="2.host模式网络"></a>2.host模式网络</h3><p>该模式将禁用Docker容器的网络隔离。因为容器共享了宿主机的网络命名空间 ，直接暴露在公共网络中。因此 ，你需要通过端口映射（port mapping）来进行协调。</p><p>通过命令–network=host指定 ，使用host模式的容器可以直接使用docker host的IP地址与外界通信 ，容器内部的服务端口也可以使用宿主机的端口 ，不需要进行NAT ，host最大的优势就是网络性能比较好 ，但是docker host上已经使用的端口就不能再用了 ，网络的隔离性不好</p><p>2.1 Host模式并没有为容器创建一个隔离的网络环境。该模式下的Docker容器会和host宿主机共享同一个网络namespace ，所以容器可以和宿 主机一样 ，使用宿主机的eth0 ，实现和外界的通信。</p><p>特点：</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">这种模式下的容器没有隔离的network namespace</span><br><span class="line">容器的IP地址同 Docker主机的IP地址</span><br><span class="line">需要注意容器中服务的端口号不能与Docker主机上已经使用的端口号相冲突</span><br><span class="line">host模式能够和其它模式共存</span><br></pre></td></tr></table></figure><p>2.2 首先我通过ss查看一下 ，我的docker主机80端口并没有使用。当我启动一个提供nginx应用的容器时 ，在查看发现我的主机使用了80端口</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# ss -lnt |grep 80</span><br><span class="line">[root@VM_0_6_centos ~]# docker run -itd --privileged --name nginx001 --network host nginx:latest</span><br><span class="line">Unable to find image &#39;nginx:latest&#39; locally</span><br><span class="line">latest: Pulling from library&#x2F;nginx</span><br><span class="line">f5d23c7fed46: Already exists </span><br><span class="line">918b255d86e5: Pull complete </span><br><span class="line">8c0120a6f561: Pull complete </span><br><span class="line">Digest: sha256:eb3320e2f9ca409b7c0aa71aea3cf7ce7d018f03a372564dbdb023646958770b</span><br><span class="line">Status: Downloaded newer image for nginx:latest</span><br><span class="line">c7ea10aa92dd09b312f844aa70a359861c8da8d4eea2bbae2353505008beea27</span><br><span class="line">[root@VM_0_6_centos ~]# docker ps</span><br><span class="line">CONTAINER ID        IMAGE               COMMAND                  CREATED              STATUS              PORTS                                           NAMES</span><br><span class="line">c7ea10aa92dd        nginx:latest        &quot;nginx -g &#39;daemon of…&quot;   About a minute ago   Up About a minute                                                   nginx001</span><br><span class="line">[root@VM_0_6_centos ~]# ss -lnt |grep 80</span><br><span class="line">LISTEN     0      128          *:80                       *:*</span><br></pre></td></tr></table></figure><p>2.3 我们还可以通过docker inspect nginx001查看它的网络信息。发现IP地址和网关处根本没有值。因为使用了host网络 ，它是共用了docker主机的网络</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[rootVM_0_6_centos ~]# docker inspect -f &#123;&#123;&quot;.NetworkSettings.Networks.bridge.IPAddress&quot;&#125;&#125; nginx001</span><br><span class="line">&lt;no value&gt;</span><br><span class="line">[root@VM_0_6_centos ~]# docker inspect -f &#123;&#123;&quot;.NetworkSettings.Networks.bridge.Gateway&quot;&#125;&#125; nginx001</span><br><span class="line">&lt;no value&gt;</span><br></pre></td></tr></table></figure><p>2.4 再例如：</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker run -d --net&#x3D;host ubuntu:14.04 tail -f &#x2F;dev&#x2F;null</span><br><span class="line">Unable to find image &#39;ubuntu:14.04&#39; locally</span><br><span class="line">14.04: Pulling from library&#x2F;ubuntu</span><br><span class="line">a7344f52cb74: Pull complete </span><br><span class="line">515c9bb51536: Pull complete </span><br><span class="line">e1eabe0537eb: Pull complete </span><br><span class="line">4701f1215c13: Pull complete </span><br><span class="line">Digest: sha256:2f7c79927b346e436cc14c92bd4e5bd778c3bd7037f35bc639ac1589a7acfa90</span><br><span class="line">Status: Downloaded newer image for ubuntu:14.04</span><br><span class="line">cb5860bbcf61d006c9654cb4678fe3a2b9cb93c2f09cc84da142113d245b6e83</span><br><span class="line">[root@VM_0_6_centos ~]#  ip addr | grep -A 2 eth0:</span><br><span class="line">2: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link&#x2F;ether 52:54:00:69:06:60 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.16.0.6&#x2F;20 brd 172.16.15.255 scope global eth0</span><br><span class="line"></span><br><span class="line">[root@VM_0_6_centos ~]# docker ps</span><br><span class="line">CONTAINER ID        IMAGE               COMMAND                  CREATED              STATUS              PORTS                                           NAMES</span><br><span class="line">cb5860bbcf61        ubuntu:14.04        &quot;tail -f &#x2F;dev&#x2F;null&quot;      About a minute ago   Up 59 seconds                                                       hungry_payne</span><br><span class="line">[root@VM_0_6_centos ~]# docker exec -it cb5860bbcf61 ip addr</span><br><span class="line">inet 172.16.0.6&#x2F;20 brd 172.16.15.255 scope global eth0</span><br></pre></td></tr></table></figure><p>我们可以从上例中看到：容器和宿主机具有相同的IP地址<code>172.16.0.6</code>。</p><p>在下图中 ，我们可以看到：当使用host模式网络时 ，容器实际上继承了宿主机的IP地址。该模式比bridge模式更快（因为没有路由开销） ，但是它将容器直接暴露在公共网络中 ，是有安全隐患的</p><h3 id="3-none模式网络"><a href="#3-none模式网络" class="headerlink" title="3.none模式网络"></a>3.none模式网络</h3><p>这种网络模式下容器只有lo回环网络 ，没有其他网卡。none网络可以在容器创建时通过–network=none来指定。这种类型的网络没有办法联网 ，封闭的网络能很好的保证容器的安全性。一旦 Docker Container 采用了none网络模式,那么容器内部就只能使用 loopback 网络设备,不会再有其他的网络资源。在没有网络配置的情况下,作为 Docker 开发者,才能在这基础做其他无限多可能的网络定制开发。</p><p>3.1 在 none 网络模式下分配固定 ip:<br>netns 是在 linux 中提供网络虚拟化的一个项目,使用 netns 网络空间虚拟化可以在本地虚拟化出多个网络环境,目前 netns 在 lxc 容器中被用来为容器提供网络。使用 netns 创建的网络空间独立于当前系统的网络空间,其中的网络设备以及 iptables 规则等都是独立的,就好像进入了另外一个网络一样</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker run -it --name vm5 --net none ubuntu</span><br></pre></td></tr></table></figure><p>3.2 这种方式创建没有网络 ，可以自己指定设置网络</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# ip addr</span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link&#x2F;loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1&#x2F;8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1&#x2F;128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br></pre></td></tr></table></figure><h3 id="4-container模式网络-共享模式"><a href="#4-container模式网络-共享模式" class="headerlink" title="4.container模式网络 共享模式"></a>4.container模式网络 共享模式</h3><p>用于容器和容器直接频繁交流的情况。</p><p>这个模式指定新创建的容器和已经存在的一个容器共享一个 Network Namespace ，而不是和宿主机共享。新创建的容器不会创建自己的网卡 ，配置自己的 IP ，而是和一个指定的容器共享 IP、端口范围等。同样 ，两个容器除了网络方面 ，其他的如文件系统、进程列表等还是隔离的。两个容器的进程可以通过 lo 网卡设备通信。</p><p>创建容器时使用–network=container:NAME_or_ID这个模式在创建新的容器的时候指定容器的网络和一个已经存在的容器共享一个Network Namespace ，但是并不为docker容器进行任何网络配置 ，这个docker容器没有网卡、IP、路由等信息 ，需要手动的去为docker容器添加网卡、配置IP等</p><p>(1) 查找 other container(即需要被共享网络环境的容器)的网络 namespace;<br>(2) 将新创建的 Docker Container(也是需要共享其他网络的容器)的 namespace,使用<br>other container 的 namespace。<br>Docker Container 的 other container 网络模式,可以用来更好的服务于容器间的通信。<br>在这种模式下的 Docker Container 可以通过 localhost 来访问 namespace 下的其他容器,传输<br>效率较高。虽然多个容器共享网络环境,但是多个容器形成的整体依然与宿主机以及其他<br>容器形成网络隔离。另外,这种模式还节约了一定数量的网络资源。但是需要注意的是,</p><p>它并没有改善容器与宿主机以外世界通信的情况</p><p>4.1 创建一个nat模式 ，看一下这个容器ip：</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker run -it --name busyboxl busybox sh</span><br><span class="line">&#x2F; # ip addr</span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue qlen 1000</span><br><span class="line">    link&#x2F;loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1&#x2F;8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">34: eth0@if35: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu 1500 qdisc noqueue </span><br><span class="line">    link&#x2F;ether 02:42:ac:11:00:05 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.5&#x2F;16 brd 172.17.255.255 scope global eth0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">&#x2F; # hostname</span><br><span class="line">d9e5c9ad1193</span><br><span class="line">&#x2F; #</span><br></pre></td></tr></table></figure><p>4.2 创建一个container网络模式的ip ，创建完成后 ，可以看到这两个ip地址是一模一样的 ，并且是可以直接通信的</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker run -it --name busybox2 --net&#x3D;container:busybox1 busybox sh</span><br><span class="line">docker: Error response from daemon: cannot join network of a non running container: 4d33b98101f85aa77e576967c64d8b83b535f99d22d82a89bdd62b15f3f96070.</span><br><span class="line">[root@VM_0_6_centos ~]# ip addr</span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link&#x2F;loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1&#x2F;8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1&#x2F;128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link&#x2F;ether 52:54:00:69:06:60 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.16.0.6&#x2F;20 brd 172.16.15.255 scope global eth0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::5054:ff:fe69:660&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;NO-CARRIER,BROADCAST,MULTICAST,UP&gt; mtu 1500 qdisc noqueue state DOWN group default </span><br><span class="line">    link&#x2F;ether 02:42:74:13:f5:ff brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1&#x2F;16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::42:74ff:fe13:f5ff&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br></pre></td></tr></table></figure><p>4.3 确认是两个容器：</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker ps -a</span><br><span class="line">CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                          PORTS               NAMES</span><br><span class="line">1af412b5e1d7        busybox             &quot;sh&quot;                58 seconds ago      Created                                             busybox2</span><br><span class="line">4d33b98101f8        busybox             &quot;sh&quot;                2 minutes ago       Exited (0) About a minute ago                       busybox1</span><br></pre></td></tr></table></figure><p>4.4 None ，不会创建网络 ，里面就不会有ip ，最常用的是nat模式和container网络模式 ，container网络模式用于容器和容器直接频繁交流的情况。</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker run -it --name none --net&#x3D;none busybox sh</span><br><span class="line">&#x2F; # ip addr</span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue qlen 1000</span><br><span class="line">    link&#x2F;loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1&#x2F;8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">&#x2F; #</span><br></pre></td></tr></table></figure><h3 id="5-user-defined模式"><a href="#5-user-defined模式" class="headerlink" title="5.user-defined模式"></a>5.user-defined模式</h3><p>用户自定义模式主要可选的有三种网络驱动：bridge、overlay、macvlan。bridge驱动用于创建类似于前面提到的bridge网络；overlay和macvlan驱动用于创建跨主机的网络。</p><h2 id="二、外部网络访问容器内应用"><a href="#二、外部网络访问容器内应用" class="headerlink" title="二、外部网络访问容器内应用"></a>二、外部网络访问容器内应用</h2><h3 id="1-P随机指定一个docker主机端口给容器中的端口做映射"><a href="#1-P随机指定一个docker主机端口给容器中的端口做映射" class="headerlink" title="1.-P随机指定一个docker主机端口给容器中的端口做映射"></a>1.-P随机指定一个docker主机端口给容器中的端口做映射</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker run -itd -P --name nginx001 nginx:latest</span><br><span class="line">b718bc214f766d154b0608819edac97da066e1edbf1617125d4b707ac4b5c6e4</span><br><span class="line">[root@VM_0_6_centos ~]# docker ps</span><br><span class="line">CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                   NAMES</span><br><span class="line">b718bc214f76        nginx:latest        &quot;nginx -g &#39;daemon of…&quot;   8 seconds ago       Up 7 seconds        0.0.0.0:32772-&gt;80&#x2F;tcp   nginx001</span><br><span class="line">[root@VM_0_6_centos ~]#</span><br></pre></td></tr></table></figure><h3 id="2-p将docker主机的一个端口映射容器的一个端口"><a href="#2-p将docker主机的一个端口映射容器的一个端口" class="headerlink" title="2.-p将docker主机的一个端口映射容器的一个端口"></a>2.-p将docker主机的一个端口映射容器的一个端口</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker run -itd -p 8000:80 --name nginx002 nginx:latest</span><br><span class="line">bb4cce60ff9da6c7e57d24f0a4d63921925e8990a3172c613d25865eb8b8ab50</span><br><span class="line"></span><br><span class="line">[root@VM_0_6_centos ~]# docker ps</span><br><span class="line">CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                   NAMES</span><br><span class="line">bb4cce60ff9d        nginx:latest        &quot;nginx -g &#39;daemon of…&quot;   13 seconds ago      Up 13 seconds       0.0.0.0:8000-&gt;80&#x2F;tcp    nginx002</span><br><span class="line">b718bc214f76        nginx:latest        &quot;nginx -g &#39;daemon of…&quot;   2 minutes ago       Up 2 minutes        0.0.0.0:32772-&gt;80&#x2F;tcp   nginx001</span><br><span class="line">[root@VM_0_6_centos ~]#</span><br></pre></td></tr></table></figure><p>访问网站测试（我的docker主机的地址为129.204.207.*** ，记住要在docker主机上放行32772和8000端口）</p><p>首先访问32768端口:129.204.207.***:32772<br>访问8000端口。（都可以正常提供服务）</p><h2 id="三、用户自定义网络"><a href="#三、用户自定义网络" class="headerlink" title="三、用户自定义网络"></a>三、用户自定义网络</h2><p>通过docker network create –driver <em>network_type</em> <em>network_name</em>命令即可创建自定义网络。其中–driver后面支持的类型有三种：bridge、macvlan、overlay</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker network ls</span><br><span class="line">NETWORK ID          NAME                DRIVER              SCOPE</span><br><span class="line">f88b1c490d20        bridge              bridge              local</span><br><span class="line">0954ad9627bc        host                host                local</span><br><span class="line">7dbe186a84e8        none                null                local</span><br><span class="line"></span><br><span class="line">[root@VM_0_6_centos ~]# ip a</span><br><span class="line"></span><br><span class="line">[root@VM_0_6_centos ~]# docker network create --driver bridge my_bridge</span><br><span class="line">326493de5458416e3a1ccbceea5e03760268ae3412c9fe78fe551dadbfc53c95</span><br><span class="line"></span><br><span class="line">[root@VM_0_6_centos ~]# docker network ls</span><br><span class="line">NETWORK ID          NAME                DRIVER              SCOPE</span><br><span class="line">f88b1c490d20        bridge              bridge              local</span><br><span class="line">0954ad9627bc        host                host                local</span><br><span class="line">326493de5458        my_bridge           bridge              local</span><br><span class="line">7dbe186a84e8        none                null                local</span><br><span class="line">[root@VM_0_6_centos ~]# ip a</span><br></pre></td></tr></table></figure><p>通过docker network inspect <em>network_name</em>可以查看该网络的信息</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker network inspect my_bridge</span><br><span class="line">[</span><br><span class="line">    &#123;</span><br><span class="line">        &quot;Name&quot;: &quot;my_bridge&quot;,</span><br><span class="line">        &quot;Id&quot;: &quot;326493de5458416e3a1ccbceea5e03760268ae3412c9fe78fe551dadbfc53c95&quot;,</span><br><span class="line">        &quot;Created&quot;: &quot;2019-08-06T15:16:08.50367479+08:00&quot;,</span><br><span class="line">        &quot;Scope&quot;: &quot;local&quot;,</span><br><span class="line">        &quot;Driver&quot;: &quot;bridge&quot;,</span><br><span class="line">        &quot;EnableIPv6&quot;: false,</span><br><span class="line">        &quot;IPAM&quot;: &#123;</span><br><span class="line">            &quot;Driver&quot;: &quot;default&quot;,</span><br><span class="line">            &quot;Options&quot;: &#123;&#125;,</span><br><span class="line">            &quot;Config&quot;: [</span><br><span class="line">                &#123;</span><br><span class="line">                    &quot;Subnet&quot;: &quot;172.18.0.0&#x2F;16&quot;,</span><br><span class="line">                    &quot;Gateway&quot;: &quot;172.18.0.1&quot;</span><br><span class="line">                &#125;</span><br><span class="line">            ]</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;Internal&quot;: false,</span><br><span class="line">        &quot;Attachable&quot;: false,</span><br><span class="line">        &quot;Ingress&quot;: false,</span><br><span class="line">        &quot;ConfigFrom&quot;: &#123;</span><br><span class="line">            &quot;Network&quot;: &quot;&quot;</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;ConfigOnly&quot;: false,</span><br><span class="line">        &quot;Containers&quot;: &#123;&#125;,</span><br><span class="line">        &quot;Options&quot;: &#123;&#125;,</span><br><span class="line">        &quot;Labels&quot;: &#123;&#125;</span><br><span class="line">    &#125;</span><br><span class="line">]</span><br></pre></td></tr></table></figure><p>而且通过ip addr可以看到自动在docker主机上创建了一个网卡</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# ip a</span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link&#x2F;loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1&#x2F;8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1&#x2F;128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link&#x2F;ether 52:54:00:69:06:60 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.16.0.6&#x2F;20 brd 172.16.15.255 scope global eth0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::5054:ff:fe69:660&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue state UP group default </span><br><span class="line">    link&#x2F;ether 02:42:74:13:f5:ff brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1&#x2F;16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::42:74ff:fe13:f5ff&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">41: vethd9e30c6@if40: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker0 state UP group default </span><br><span class="line">    link&#x2F;ether ca:e9:0a:6d:c6:09 brd ff:ff:ff:ff:ff:ff link-netnsid 0</span><br><span class="line">    inet6 fe80::c8e9:aff:fe6d:c609&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">43: veth2946b2c@if42: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker0 state UP group default </span><br><span class="line">    link&#x2F;ether 02:65:c5:d4:31:e6 brd ff:ff:ff:ff:ff:ff link-netnsid 1</span><br><span class="line">    inet6 fe80::65:c5ff:fed4:31e6&#x2F;64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">44: br-326493de5458: &lt;NO-CARRIER,BROADCAST,MULTICAST,UP&gt; mtu 1500 qdisc noqueue state DOWN group default </span><br><span class="line">    link&#x2F;ether 02:42:00:7c:2f:07 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.18.0.1&#x2F;16 brd 172.18.255.255 scope global br-326493de5458</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br></pre></td></tr></table></figure><p>查看主机的 NAT 规则：<br>再次查看我们nat表 ，也可以看到在POSTROUTING上做的MASQUERADE</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]#  iptables -t nat -vnL</span><br><span class="line">Chain POSTROUTING (policy ACCEPT 198 packets, 12868 bytes)</span><br><span class="line"> pkts bytes target     prot opt in     out     source               destination         </span><br><span class="line">    0     0 MASQUERADE  all  --  *      !br-326493de5458  172.18.0.0&#x2F;16        0.0.0.0&#x2F;0</span><br></pre></td></tr></table></figure><p>这样我们就可以运行容器使用该网络了</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker run -itd --name&#x3D;nginx001 --network my_bridge nginx</span><br><span class="line">0200f80a916ad188be333232d8eed64c87f19b4c9229c948bc6de1376bd76125</span><br><span class="line">[root@VM_0_6_centos ~]# docker ps</span><br><span class="line">CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS               NAMES</span><br><span class="line">0200f80a916a        nginx               &quot;nginx -g &#39;daemon of…&quot;   6 seconds ago       Up 5 seconds        80&#x2F;tcp              nginx001</span><br><span class="line">[root@VM_0_6_centos ~]# docker inspect -f &#123;&#123;&quot;.NetworkSettings.Networks.bridge.Gateway&quot;&#125;&#125; nginx001</span><br><span class="line">172.18.0.1</span><br><span class="line">[root@VM_0_6_centos ~]# docker inspect -f &#123;&#123;&quot;.NetworkSettings.Networks.bridge.IPAddress&quot;&#125;&#125; nginx001</span><br><span class="line">172.18.0.2</span><br></pre></td></tr></table></figure><h2 id="四、docker-network管理命令的使用"><a href="#四、docker-network管理命令的使用" class="headerlink" title="四、docker network管理命令的使用"></a>四、docker network管理命令的使用</h2><h3 id="1-基本使用："><a href="#1-基本使用：" class="headerlink" title="1.基本使用："></a>1.基本使用：</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br></pre></td><td class="code"><pre><span class="line"># 创建一个网络</span><br><span class="line">[root@VM_0_6_centos ~]# docker network create --driver bridge bridge_1</span><br><span class="line">b3a6a2b1063dcca0e6dd26d92c60fbb0dc7ba8bf5b55dff9fb10849343d28b0d</span><br><span class="line"></span><br><span class="line"># 查看所有网络</span><br><span class="line">[root@VM_0_6_centos ~]# docker network ls</span><br><span class="line">NETWORK ID          NAME                DRIVER              SCOPE</span><br><span class="line">f88b1c490d20        bridge              bridge              local</span><br><span class="line">b3a6a2b1063d        bridge_1            bridge              local</span><br><span class="line">0954ad9627bc        host                host                local</span><br><span class="line">326493de5458        my_bridge           bridge              local</span><br><span class="line">7dbe186a84e8        none                null                local</span><br><span class="line"></span><br><span class="line"># 断开一个网路的连接</span><br><span class="line">[root@VM_0_6_centos ~]# docker network disconnect bridge_1</span><br><span class="line">&quot;docker network disconnect&quot; requires exactly 2 arguments.</span><br><span class="line">See &#39;docker network disconnect --help&#39;.</span><br><span class="line"></span><br><span class="line">Usage:  docker network disconnect [OPTIONS] NETWORK CONTAINER</span><br><span class="line"></span><br><span class="line">Disconnect a container from a network</span><br><span class="line"></span><br><span class="line">#连接一个网络</span><br><span class="line">[root@VM_0_6_centos ~]# docker network connect bridge_1</span><br><span class="line">&quot;docker network connect&quot; requires exactly 2 arguments.</span><br><span class="line">See &#39;docker network connect --help&#39;.</span><br><span class="line"></span><br><span class="line">Usage:  docker network connect [OPTIONS] NETWORK CONTAINER</span><br><span class="line"></span><br><span class="line">Connect a container to a network</span><br><span class="line"></span><br><span class="line"># 删除一个网络</span><br><span class="line">[root@VM_0_6_centos ~]# docker network rm bridge_1</span><br><span class="line">bridge_1</span><br><span class="line"></span><br><span class="line"># 查看所有网络</span><br><span class="line">[root@VM_0_6_centos ~]# docker network ls</span><br><span class="line">NETWORK ID          NAME                DRIVER              SCOPE</span><br><span class="line">f88b1c490d20        bridge              bridge              local</span><br><span class="line">0954ad9627bc        host                host                local</span><br><span class="line">326493de5458        my_bridge           bridge              local</span><br><span class="line">7dbe186a84e8        none                null                local</span><br><span class="line">[root@VM_0_6_centos ~]#</span><br></pre></td></tr></table></figure><h3 id="2-显示一个网络的信息："><a href="#2-显示一个网络的信息：" class="headerlink" title="2.显示一个网络的信息："></a>2.显示一个网络的信息：</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line">[root@VM_0_6_centos ~]# docker inspect host</span><br><span class="line">[</span><br><span class="line">    &#123;</span><br><span class="line">        &quot;Name&quot;: &quot;host&quot;,</span><br><span class="line">        &quot;Id&quot;: &quot;0954ad9627bc02e971eb92c9f625dced9c86d994d09217d5fbc609aa4efc608d&quot;,</span><br><span class="line">        &quot;Created&quot;: &quot;2019-07-30T18:03:34.674156886+08:00&quot;,</span><br><span class="line">        &quot;Scope&quot;: &quot;local&quot;,</span><br><span class="line">        &quot;Driver&quot;: &quot;host&quot;,</span><br><span class="line">        &quot;EnableIPv6&quot;: false,</span><br><span class="line">        &quot;IPAM&quot;: &#123;</span><br><span class="line">            &quot;Driver&quot;: &quot;default&quot;,</span><br><span class="line">            &quot;Options&quot;: null,</span><br><span class="line">            &quot;Config&quot;: []</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;Internal&quot;: false,</span><br><span class="line">        &quot;Attachable&quot;: false,</span><br><span class="line">        &quot;Ingress&quot;: false,</span><br><span class="line">        &quot;ConfigFrom&quot;: &#123;</span><br><span class="line">            &quot;Network&quot;: &quot;&quot;</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;ConfigOnly&quot;: false,</span><br><span class="line">        &quot;Containers&quot;: &#123;&#125;,</span><br><span class="line">        &quot;Options&quot;: &#123;&#125;,</span><br><span class="line">        &quot;Labels&quot;: &#123;&#125;</span><br><span class="line">    &#125;</span><br><span class="line">]</span><br></pre></td></tr></table></figure><h2 id="五、跨主机docker容器通信方案介绍"><a href="#五、跨主机docker容器通信方案介绍" class="headerlink" title="五、跨主机docker容器通信方案介绍"></a>五、跨主机docker容器通信方案介绍</h2><h3 id="1-基于实现方式的分类"><a href="#1-基于实现方式的分类" class="headerlink" title="1.基于实现方式的分类"></a>1.基于实现方式的分类</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">隧道方案（Overlay Networking）：</span><br><span class="line">Weave：UDP广播 ，本机建立新的BR ，通过PCAP互通。</span><br><span class="line">Open vSwitch(OVS)：基于VxLAN和GRE协议 ，但是性能方面损失比较严重。</span><br><span class="line">Flannel：UDP广播 ，VxLan。</span><br></pre></td></tr></table></figure><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">路由方案：</span><br><span class="line">Calico：基于BGP协议的路由方案 ，支持很细致的ACL控制 ，对混合云亲和度比较</span><br><span class="line">高。</span><br><span class="line">Macvlan：从逻辑和Kernel层来看隔离性和性能最优的方案 ，基于二层隔离 ，所以</span><br><span class="line">需要二层路由器支持 ，大多数云服务商不支持 ，所以混合云上比较难以实现。</span><br></pre></td></tr></table></figure><h3 id="2-基于网络模型分类"><a href="#2-基于网络模型分类" class="headerlink" title="2.基于网络模型分类"></a>2.基于网络模型分类</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">Docker Libnetwork Container Network Model(CNM)：</span><br><span class="line">Docker Swarm overlay</span><br><span class="line">Macvlan &amp; IP network drivers</span><br><span class="line">Calico</span><br><span class="line">Contiv（<span class="keyword">from</span> Cisco）</span><br><span class="line"><span class="comment">##Docker Libnetwork的优势就是原生 ，而且和Docker容器生命周期结合紧密；缺点也可以理解为是原生 ，被Docker“绑架”。</span></span><br></pre></td></tr></table></figure><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">Container Network Interface(CNI)：</span><br><span class="line">Kubernetes</span><br><span class="line">Weave</span><br><span class="line">Macvlan</span><br><span class="line">Flannel</span><br><span class="line">Calico</span><br><span class="line">Contiv</span><br><span class="line">Mesos CNI</span><br><span class="line"><span class="comment">##CNI的优势是兼容其他容器技术(e.g. rkt)及上层编排系统(Kuberneres &amp; Mesos) ，而且社区活</span></span><br><span class="line">跃势头迅猛 ，Kubernetes加上CoreOS主推；缺点是非Docker原生。</span><br></pre></td></tr></table></figure><h3 id="3-以Flannel方案为例"><a href="#3-以Flannel方案为例" class="headerlink" title="3.以Flannel方案为例"></a>3.以Flannel方案为例</h3><p>Flannel之前的名字是Rudder ，它是由CoreOS团队针对Kubernetes设计的一个重载网络工具 ，它的主要思路是：预先留出一个网段 ，每个主机使用其中一部分 ，然后每个容器被分配不同的ip；让所有的容器认为大家在同一个直连的网络 ，底层通过UDP/VxLAN等进行报文的封装和转发。<br>下面这张是Flannel网络的经典架构图（从网上找的）<br><img src="https://upload-images.jianshu.io/upload_images/15645795-ac6abc9b4320fe68.png" alt="Flannel网络1.png"></p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="number">1.</span> 容器直接使用目标容器的ip访问 ，默认通过容器内部的eth0发送出去。 </span><br><span class="line"><span class="number">2.</span> 报文通过veth pair被发送到vethXXX。 </span><br><span class="line"><span class="number">3.</span> vethXXX是直接连接到虚拟交换机docker0的 ，报文通过虚拟bridge docker0发送出去。 </span><br><span class="line"><span class="number">4.</span> 查找路由表 ，外部容器ip的报文都会转发到flannel0虚拟网卡 ，这是一个P2P的虚拟网卡 ，然后报文就被转发到监听在另一端的flanneld。 </span><br><span class="line"><span class="number">5.</span> flanneld通过etcd维护了各个节点之间的路由表 ，把原来的报文UDP封装一层 ，通过配置的iface发送出去。 </span><br><span class="line"><span class="number">6.</span> 报文通过主机之间的网络找到目标主机。 </span><br><span class="line"><span class="number">7.</span> 报文继续往上 ，到传输层 ，交给监听在<span class="number">8285</span>端口的flanneld程序处理。 </span><br><span class="line"><span class="number">8.</span> 数据被解包 ，然后发送给flannel0虚拟网卡。 </span><br><span class="line"><span class="number">9.</span> 查找路由表 ，发现对应容器的报文要交给docker0。 </span><br><span class="line"><span class="number">10.</span> docker0找到连到自己的容器 ，把报文发送过去。</span><br></pre></td></tr></table></figure></div><div class="popular-posts-header"><p style="font-size:18px;color:red;margin:0 0 5px 0">相关文章推荐：</p></div><ul class="popular-posts"><li class="popular-posts-item"><div class="popular-posts-title"><a href="\posts\2258780281.html" rel="bookmark">Docker命令汇总</a></div></li><li class="popular-posts-item"><div class="popular-posts-title"><a href="\posts\2129580319.html" rel="bookmark">Docker备份和迁移</a></div></li><li class="popular-posts-item"><div class="popular-posts-title"><a href="\posts\4207098197.html" rel="bookmark">Docker安装常用软件1</a></div></li><li class="popular-posts-item"><div class="popular-posts-title"><a href="\posts\1674209519.html" rel="bookmark">Docker安装常用软件2</a></div></li><li class="popular-posts-item"><div class="popular-posts-title"><a href="\posts\349001849.html" rel="bookmark">Docker安装常用软件3</a></div></li><li class="popular-posts-item"><div class="popular-posts-title"><a href="\posts\3160818968.html" rel="bookmark">Docker日志实时查看和清理</a></div></li><li class="popular-posts-item"><div class="popular-posts-title"><a href="\posts\382972034.html" rel="bookmark">Linux下安装Docker</a></div></li><li class="popular-posts-item"><div class="popular-posts-title"><a href="\posts\1424390860.html" rel="bookmark">docker安装遇到的问题</a></div></li></ul><div><div style="text-align:center;color:#ccc;font-size:14px">-------------本文结束<i class="fa fa-paw"></i>感谢您的阅读-------------</div></div><div class="reward-container"><div><p style="font-size:14px;color:#34495e;margin:0 0 5px 0">赞赏一下吧～ 还可以关注公众号订阅最新内容</p></div><button disable="enable" onclick="var qr = document.getElementById(&quot;qr&quot;); qr.style.display = (qr.style.display === 'none') ? 'block' : 'none';">打赏</button><div id="qr" style="display:none"><div style="display:inline-block"><img src="/my-images/WeChat.png" alt="宇宙小神特别萌 微信支付"><p>微信支付</p></div><div style="display:inline-block"><img src="/my-images/Alipay.png" alt="宇宙小神特别萌 支付宝"><p>支付宝</p></div></div></div><footer class="post-footer"><div class="post-tags"><a href="/tags/Docker/" rel="tag"><i class="fa fa-tag"></i> Docker</a></div><div class="post-nav"><div class="post-nav-item"><a href="/posts/2129580319.html" rel="prev" title="Docker备份和迁移"><i class="fa fa-chevron-left"></i> Docker备份和迁移</a></div><div class="post-nav-item"><a href="/posts/2258780281.html" rel="next" title="Docker命令汇总">Docker命令汇总 <i class="fa fa-chevron-right"></i></a></div></div></footer></article></div></div><div class="comments" id="valine-comments"></div><script>window.addEventListener('tabs:register', () => {
    let activeClass = CONFIG.comments.activeClass;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      let activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      let commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }</script></div><div class="toggle sidebar-toggle"><span class="toggle-line toggle-line-first"></span> <span class="toggle-line toggle-line-middle"></span> <span class="toggle-line toggle-line-last"></span></div><aside class="sidebar"><div class="sidebar-inner"><ul class="sidebar-nav motion-element"><li class="sidebar-nav-toc">文章目录</li><li class="sidebar-nav-overview">站点概览</li></ul><div class="post-toc-wrap sidebar-panel"><div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#一、有哪五种模式网络："><span class="nav-text">一、有哪五种模式网络：</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1-bridge模式网络"><span class="nav-text">1.bridge模式网络</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-host模式网络"><span class="nav-text">2.host模式网络</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3-none模式网络"><span class="nav-text">3.none模式网络</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#4-container模式网络-共享模式"><span class="nav-text">4.container模式网络 共享模式</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#5-user-defined模式"><span class="nav-text">5.user-defined模式</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#二、外部网络访问容器内应用"><span class="nav-text">二、外部网络访问容器内应用</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1-P随机指定一个docker主机端口给容器中的端口做映射"><span class="nav-text">1.-P随机指定一个docker主机端口给容器中的端口做映射</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-p将docker主机的一个端口映射容器的一个端口"><span class="nav-text">2.-p将docker主机的一个端口映射容器的一个端口</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#三、用户自定义网络"><span class="nav-text">三、用户自定义网络</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#四、docker-network管理命令的使用"><span class="nav-text">四、docker network管理命令的使用</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1-基本使用："><span class="nav-text">1.基本使用：</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-显示一个网络的信息："><span class="nav-text">2.显示一个网络的信息：</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#五、跨主机docker容器通信方案介绍"><span class="nav-text">五、跨主机docker容器通信方案介绍</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1-基于实现方式的分类"><span class="nav-text">1.基于实现方式的分类</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-基于网络模型分类"><span class="nav-text">2.基于网络模型分类</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3-以Flannel方案为例"><span class="nav-text">3.以Flannel方案为例</span></a></li></ol></li></ol></div></div><div class="site-overview-wrap sidebar-panel"><div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person"><img class="site-author-image" itemprop="image" alt="宇宙小神特别萌" src="/my-images/avatar.gif"><p class="site-author-name" itemprop="name">宇宙小神特别萌</p><div class="site-description" itemprop="description">人生就是一次幸运的旅行！</div></div><div class="site-state-wrap motion-element"><nav class="site-state"><div class="site-state-item site-state-posts"><a href="/archives/"><span class="site-state-item-count">116</span> <span class="site-state-item-name">文章</span></a></div><div class="site-state-item site-state-tags"><a href="/tags/"><span class="site-state-item-count">27</span> <span class="site-state-item-name">标签</span></a></div></nav></div><div class="links-of-author motion-element"><span class="links-of-author-item"><a href="https://github.com/zhengjiaao" title="GitHub → https:&#x2F;&#x2F;github.com&#x2F;zhengjiaao" rel="noopener" target="_blank"><i class="fa fa-fw fa-github"></i>GitHub</a> </span><span class="links-of-author-item"><a href="https://www.jianshu.com/u/70d69269bd09" title="简书 → https:&#x2F;&#x2F;www.jianshu.com&#x2F;u&#x2F;70d69269bd09" rel="noopener" target="_blank"><i class="fa fa-fw fa-book"></i>简书</a> </span><span class="links-of-author-item"><a href="/atom.xml" title="RSS → &#x2F;atom.xml"><i class="fa fa-fw fa-rss"></i>RSS</a></span></div><div class="links-of-blogroll motion-element"><div class="links-of-blogroll-title"><i class="fa fa-fw fa-link"></i> 推荐阅读</div><ul class="links-of-blogroll-list"><li class="links-of-blogroll-item"><a href="https://github.com/spring-projects" title="https:&#x2F;&#x2F;github.com&#x2F;spring-projects" rel="noopener" target="_blank">spring-projects</a></li><li class="links-of-blogroll-item"><a href="http://www.alloyteam.com/nav/" title="http:&#x2F;&#x2F;www.alloyteam.com&#x2F;nav&#x2F;" rel="noopener" target="_blank">Web前端导航</a></li><li class="links-of-blogroll-item"><a href="http://www.chuangzaoshi.com/code" title="http:&#x2F;&#x2F;www.chuangzaoshi.com&#x2F;code" rel="noopener" target="_blank">创造狮导航</a></li></ul></div></div></div></aside><div id="sidebar-dimmer"></div></div></main><footer class="footer"><div class="footer-inner"><div class="copyright">&copy; <span itemprop="copyrightYear">2020</span> <span class="with-love"><i class="fa fa-heart"></i> </span><span class="author" itemprop="copyrightHolder">宇宙小神特别萌</span> <span class="post-meta-divider">|</span> <span class="post-meta-item-icon"><i class="fa fa-area-chart"></i> </span><span title="站点总字数">1.2m</span> <span class="post-meta-divider">|</span> <span class="post-meta-item-icon"><i class="fa fa-coffee"></i> </span><span title="站点阅读时长">17:41</span></div><div class="busuanzi-count"><script async src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script><span class="post-meta-item" id="busuanzi_container_site_uv" style="display:none"><span class="post-meta-item-icon"><i class="fa fa-user"></i> </span><span class="site-uv" title="总访客量"><span id="busuanzi_value_site_uv"></span> </span></span><span class="post-meta-divider">|</span> <span class="post-meta-item" id="busuanzi_container_site_pv" style="display:none"><span class="post-meta-item-icon"><i class="fa fa-eye"></i> </span><span class="site-pv" title="总访问量"><span id="busuanzi_value_site_pv"></span></span></span></div></div></footer></div><script src="//cdn.jsdelivr.net/npm/animejs@3.1.0/lib/anime.min.js"></script><script src="//cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js"></script><script src="//cdn.jsdelivr.net/gh/fancyapps/fancybox@3/dist/jquery.fancybox.min.js"></script><script src="//cdnjs.cloudflare.com/ajax/libs/velocity/1.2.1/velocity.min.js"></script><script src="//cdnjs.cloudflare.com/ajax/libs/velocity/1.2.1/velocity.ui.min.js"></script><script src="/js/utils.js"></script><script src="/js/motion.js"></script><script src="/js/schemes/muse.js"></script><script src="/js/next-boot.js"></script><script src="/js/bookmark.js"></script><script>!function(){var t=document.createElement("script"),e=window.location.protocol.split(":")[0];t.src="https"===e?"https://zz.bdstatic.com/linksubmit/push.js":"http://push.zhanzhang.baidu.com/push.js";var s=document.getElementsByTagName("script")[0];s.parentNode.insertBefore(t,s)}()</script><script src="/js/local-search.js"></script><script>NexT.utils.loadComments(document.querySelector('#valine-comments'), () => {
  NexT.utils.getScript('//cdnjs.cloudflare.com/ajax/libs/valine/1.3.10/Valine.min.js', () => {
    <!--var GUEST = ['nick', 'mail', 'link'];-->
    var GUEST = ['nick', 'mail'];
    var guest = 'nick,mail,link';
    guest = guest.split(',').filter(item => {
      return GUEST.includes(item);
    });
    new Valine({
      el: '#valine-comments',
      verify: false,
      notify: false,
      appId: 'OuyHeA0XGL8hK4vgbqL0iERx-gzGzoHsz',
      appKey: 'L58VglKmWULcGK2W2AN7kWzM',
      placeholder: "留下邮箱，有回复时你将收到提醒，邮箱不会被公开。",
      avatar: 'wavatar',
      meta: guest,
      pageSize: '10' || 10,
      visitor: true,
      lang: 'zh-cn' || 'zh-cn',
      path: location.pathname,
      recordIP: true,
      serverURLs: ''
    });
  }, window.Valine);
});</script><script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({pluginRootPath:"live2dw/",pluginJsPath:"lib/",pluginModelPath:"assets/",tagMode:!1,model:{jsonPath:"/live2dw/assets/wanko.model.json"},display:{position:"right",width:150,height:300},mobile:{show:!1},log:!1})</script></body><script type="text/javascript" src="/js/src/activetitle.js"></script></html><!-- rebuild by neat -->